InfoSecBulletin Cybersecurity for mankind
GitLab has issued a warning about a serious vulnerability in its GitLab Community and Enterprise editions. This vulnerability allows attackers to execute pipeline jobs as if they were another user.
GitLab’s DevSecOps platform is used by more than 30 million registered users, including T-Mobile, Goldman Sachs, Airbus, Lockheed Martin, Nvidia, and UBS. It is also preferred by over 50% of Fortune 100 companies.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
The security update fixed a flaw identified as CVE-2024-6385 with a severity rating of 9.6 out of 10.
ViperSoftX malware secretly uses AutoIT scripting to run PowerShell. It affects GitLab CE/EE versions from 15.8 to 16.11.6, 17.0 to 17.0.4, and 17.1 to 17.1.2. Attackers can exploit this to start a new pipeline as a different user, under specific conditions which GitLab has not yet revealed.
GitLab pipelines are a feature of a system called Continuous Integration/Continuous Deployment (CI/CD). They allow users to run processes and tasks automatically, either at the same time or one after the other, in order to build, test, or deploy changes to the code.
Company released GitLab Community and Enterprise versions 17.1.2, 17.0.4, and 16.11.6 to fix security flaw. Admins are advised to upgrade all installations right away.
“We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible,” it warned. “GitLab.com and GitLab Dedicated are already running the patched version.”
